Evidence Tampering
Prevention
Character
String
ed4756cd
0e660de2dc10d8f31f78776f34ebc6fc
Image
Audio
File
Hash Value
>>click on each component of the hashing process
Any type of data
Video
Password
The mathematical or logical operation
Hash
Function
A fixed-size numeric representation of the input’s contents
1582054665
Documents
Downloaded
File
2/9
Hashing is the process of converting an input of any length using a mathematical or logical function into a fixed-sized output called a hash value or hash digest.
93a6bc0e0b9b7cecf30d0a1303a1da3621088f55dd3f9251b48e55b198a63902
0
A computer stores all data types as binary data. Hashes work on the binary data directly no matter what type of input is hashed.
1
3/9
0000 1101
Adding:
0100 0001 = 65
0100 0010 = 66
0100 0011 = 67
0100 0100 = 68
The secret to how the hash function generates a fixed-size digest is in the extracting of the results. This checksum function adds the binary numbers together to calculate a sum, and uses only the first eight bits as the digest. The same message digest will result every time the process is repeated.
click on password to continue
13
Password is ABCD
no carry over--only uses eight least significant digits
A = 0100 0001
B = 0100 0010
C = 0100 0011
D = 0100 0100
Menu
click grinder to continue
1 0000 1101 = 266
0000 0100
Another way to generate f fixed-size digest is to use a Boolean opeation (AND, OR, XOR). The XOR operation is the most common. Again, the message digest will always be the same when given the same input.
04
XOR=030100 0011 = 67
XOR=64
XOR0100 0001 = 65
0100 0010 = 66
XOR=03
XOR=640100 0100 = 68
= 136
130 + 132 + 134 + 136 = 664
= 130
664 = 0010 1001 1000
1001 1000 = 98
Shift 65
1000001
Shift 67
1000011
Complex function: rotated then added
0100 0001 = 65
0100 0010 = 66
0100 0011 = 67
0100 0100 = 68
Shift 66
1000010
= 132
0010 1001 1000
Shift 68
1000100
A complex operation rotates the data before summing the results. Each input byte rotates by one bit. The most significant bit on the left takes the least significant position on the right. All other bits shift one position to the left. Then you sum all of the bytes. The first eight bits are used as the digest.
= 134
Hashing
Password
Created:
Bob creates his password. The system hashes the password, and the message digest is what actually gets stored on the system. Bob’s actual password is NOT saved on the system.
#
G00dDog
2/8
The system stores Bob’s password as a hash. The next time he enters his password, the password gets hashed and compared to the hash stored in the authentication table. If the hashes do not match, the user is denied access.
Password
Entered:
Hash saved for G00dDog
GoodDog
Bernie
Bob is the payroll administrator for ACME, and he is currently updating the Payroll Report. Since this file is also used by several others in the organization, Bob performs a hash on the file and saves the results. Anyone else that performs a hash on the file will receive the same hash value and knows that the file has not been changed and its integrity has been maintained.
Click Bernie to continue
4/4
3/4
Bernie sends data to Bob. Bernie’s system segments and organizes the data into data units called packets. After forming each packet, it calculates a hash based on the binary data in that packet. The hash gets appended to the packet, and the frame gets transmitted.
When Bob receives the packet, his system verifies its content using the hash appended to the data unit. If the data was corrupted during transmission, the hash values will not match. Bob’s device will request that any corrupted packet be re-transmitted. This provides for trustworthy communication and save bandwidth by only retransmitting corrupted packets instead of the entire file.
Bob
1/4
2/4
Resend packet
3/4
cd8ed4eebac3c7dc5c0644f5a3e27e8
cd8ed4eebac3c7dc5c0644f5a3e27e8
<< click on locker to open
Bernie confiscated a hard drive as evidence from a crime scene. He will use a hash function to obtain a hash digest before storing the drive in the evidence locker. When Bob, the forensic analyst, goes to begin his investigation, he will use that hash digest to ensure that this evidence has not been tampered with.